Planet Foo-Projects

Brian Tarricone: Advogato?

Brian — Thu, 26 Jun 2008 00:31:22 +0000

Some time ago I registered an Advogato account, but never really did anything with it. I was just poking around, and it seems there isn’t much I can do with the site without being certified by some unknown number of people first. So, if you believe that I’m actually me, and have an Advogato account, gimme some kind of certification.

Brian Tarricone: HTTPS is broken and Firefox 3 makes it worse

Brian — Mon, 16 Jun 2008 19:42:02 +0000

[Note: this is mainly a long rant. If you're just curious about my possible solutions, scroll to the last few paragraphs.]

I’ve been using the Firefox 3 betas (and now release candidates) for quite a few months now, and overall, I think it’s a great improvement over Firefox 2. My main issues in the past with FF2 have always been with performance and memory usage, and FF3 seems to go very far in addressing both of these (though there’s always still room to improve).

However, there’s one thing I just can’t get over: the SSL error pages. Before I describe FF3’s added annoyance here, let me start by saying one thing: the HTTPS model is broken and much less useful than it could be.

Why?

Because the HTTPS/SSL model tries to simultaneously combine two things: encryption and authentication. When you visit a HTTPS site, you get an end-to-end encrypted connection between your web browser and the web server, obviously. But you also get something else, in theory: assurance that the web server on the other end is actually owned and operated by who it says it is. This is done through a hierarchical certificate signing scheme, wherein the browser knows a few “trusted” root certificate authorities (CAs), and any web server SSL certificate that wants to be considered “trusted” (as far as the browser is concerned) needs to ultimately be signed by one of those root CAs. (In practice, this doesn’t mean each and every web server SSL cert needs to be signed by a root CA, just that every trusted SSL cert needs to be signed by another signing certificate that was signed by a root CA, or by another signing cert that is signed by a root CA somewhere in its ancestry.)

So where’s the flaw? Getting your SSL cert signed by a trusted cert authority costs money. This is fine for banks, but not so fine for some random guy who just wants secure communications with his home server, or webmail, or just a small self-funded website where an encrypted connection makes sense. A semi-solution is self-signed certificates. You can create your own SSL certificate, and your web server will use it, and people who connect to your web server on the HTTPS port will get encryption. But, as far as the browser is concerned, your cert isn’t signed by anyone on its trusted list.

So, the website visitor is usually presented with a confusing dialog box warning that the website they’re visiting shouldn’t be trusted. Visitors who understand all this stuff just roll their eyes, click the “allow” button and go on with their day. People who don’t really understand all this, but just want to visit the site, blindly click “allow” and go on with their day. Some panicky users may freak out, click “cancel,” and not visit the site.

The people in the middle there are the ones in danger. Blindly accepting dialog boxes just to get them out of the way can get you in trouble if the dialog box is actually warning you of something important. In the context of visiting Gentoo’s HTTPS bug tracker website, the warning actually is unimportant: Gentoo is just using a self-signed cert to avoid paying for a “real” cert, and just wants HTTPS for the encryption, not for the authentication. However, in the context of Bank of America’s online banking service (just to pick one), the warning is very important: it likely means that someone has intercepted your communications and is trying to masquerade as BoA’s server so they can steal your bank account credentials. Or it could also mean you typed the URL incorrectly, and someone malicious has registered the typo-hostname in the hopes of snaring someone with careless fingers.

So there’s a problem, definitely. The Firefox 3 developers have chosen to attack this problem by attempting to push people into the panicky-user camp, though they misguidedly believe that they’re actually getting users to try to read the messages and make an “informed” decision (despite the fact that they haven’t given — and really can’t give — enough information to inform most users). The new SSL error pages in Firefox 3 put up a scary, confusing, uninformative message right inside the browser window. The message, at first glance, looks reminiscent of one of the several “connection error” messages, so the first reaction is to look up at the address bar to see if you typed the address correctly, and then wonder why the site is down. Then you go and read the error message. Basically, it says a lot of confusing things — including a semi-raw error enumeration code that is sure to confuse the user even more — with a very short explanation of the real problem: “The certificate is not trusted because it is self signed.” What are the chances that the average user will know what this means? Slim to none.

Then there’s some text about adding an exception, and instead of a button, a URL link (in a small font) that you can click to add an exception. Well, sorta. Clicking the link merely modifies the error page to display another semi-scary message, and then shows two buttons: one with a stupid caption: “Get me out of here!” (don’t get me started on this one), and the other saying “Add Exception…” Ok, fine, so I click “Add Exception…” Now I get a dialog box, and my eyes automatically seek the bottom of the box, assuming the “confirm” button will be there, waiting for me to click. But it’s not. It’s there, but it’s disabled. Huh? So I look up higher, and I see that only two buttons can be clicked: a “Cancel” button (well, duh, obviously that’s not it), and a “Get Certificate” button. Ok, well, I guess I’ll try that one. Now the text in the middle of the box changes to tell me “Certificate is not trusted, because it hasn’t been verified by a recognized authority.” What? I know what all this stuff means, and I have to read it twice to get it. Your average user doesn’t stand a chance. Finally, though, the “confirm” button is active, and they’ve helpfully (wow, they actually did something remotely helpful here!) pre-checked the “Permanently store this exception” check box for me.

So, in total, I have to make four clicks, plus read a bunch of confusing terminology, to get to a website with a self-signed SSL certificate.

This sucks. The UI is absolutely terrible, and the average web user is going to have no idea what’s going on. According to the Firefox developers, one of the goals of these new error pages is to cut down on “dialog box whack-a-mole” where users just blindly click to get the dialog out of the way. I fail to see how this is going to help. Some users will now get even more confused, and not visit the site. For the *extremely* rare case where a malicious site is masquerading as the site they actually want, this is good. But for the much more common case of an innocent site that just wants SSL for the encryption, this is bad. And for most of the users in the “blindly dismiss” bunch, they’ll just get used to blindly dismissing this new page+dialog in record time.

What’s the real solution? Ideally: scrap the current system. There’s no reason why connection encryption needs to be so tightly coupled with authentication/identification. Design a new system, possibly with a new protocol scheme. One scheme should be used for “strong” security, where both the identity of the site and cryptographic strength of the connection are checked. The other scheme will just check the encryption. Users will need to be educated that you never try to connect to your banking site using the less-secure scheme. Sure, user education is always a problem, but it’s a problem we still face with the current non-solutions in place.

Of course, in the real world, we can’t just scrap a protocol that has been in use for over a decade, and expect everyone (web servers, web browsers, the cert-signing industry) to change overnight — or at all.

So I’d advocate dropping all the panic about self-signed certs and, in addition, handling HTTPS sites by keeping more state about them in the browser. For starters, at the simplest level, let’s stop putting up scary messages when we hit a self-signed site. We’re already coloring the address bar differently for HTTPS sites; why not have a different (slightly scary?) color for HTTPS sites that use self-signed certs? There could even be an easily-disableable bubble popup (that doesn’t take focus!) that points out the “problem” and is clickable for more information. Or something like that. At minimum, if you visit your bank site all the time and *don’t* see this warning and color change, you’ll think twice the time you do.

But to make this stronger, the browser can keep state about the HTTPS sites we’ve visited. Odds are, the first time you visit your banking site, it’ll probably be all correct and proper. So the browser notes the cert’s fingerprint, and the fact that it’s signed by a “trusted” authority, and checks it every time you visit the site. If the cert changes, and is now self-signed, the browser can raise a larger red flag: “Hey, this site that you visit all the time that usually has a trusted cert? Well, the cert is now self-signed and this might be someone trying to trick you.”

What about “phishing” attempts that use common misspellings? Well, if the browser knows that I’ve visited https://bankofamerica.com/ in the past, and it had a valid, trusted cert, and now I’ve visited https://bankofamarica.com/, and it not only has a self-signed cert, but has remarkably similar spelling to another site I visit that has a trusted cert, the browser can raise another big red flag. Finding similar spellings is nothing new: there are algorithms to do this that are old and very well-established.

How about phishing attempts that hide the true website URL by using an inline username/password string that looks familiar to the user? Well, we already cover this: Firefox pops up a dialog asking if you really want to connect to the site, presenting the real hostname, and showing the username passed in the URL. So, this new scheme doesn’t harm this case’s solution.

End rant.

Brian Tarricone: Wordpress 2.5.1 hates mod_security, sorta

Brian — Sun, 25 May 2008 22:18:23 +0000

I upgraded to Wordpress 2.5.1 a few weeks ago. Overall, it seems pretty nice.

Friday, everything was fine. Saturday, I tried to make a post, but when I clicked the “Publish” button, I got a blank webpage. Suck.

So I spent a couple hours (ugh) tracking the problem down today, and finally discovered this in the Apache error log:

[Sun May 25 14:41:59 2008] [error] [client 24.130.18.75] mod_security: Access denied with code 503. Unknown error [severity "EMERGENCY"] [hostname "spuriousinterrupt.org"] [uri "/journal/wp-admin/admin-ajax.php"]

Not a particularly useful error message. Fortunately, my web host (Dreamhost) allows me to disable mod_security on a per-domain basis, so I tried that, and voila, everything works fine. Presumably my web host upgraded mod_security, or changed its configuration, sometime between Friday and Saturday which broke things, as I didn’t change anything with Wordpress or my website.

So, if Wordpress breaks for you at some point, be sure to check your mod_security configuration, or temporarily disable it entirely to see if that’s the problem.

Hopefully Dreamhost can help me find a better solution than disabling it entirely…

Brian Tarricone: Cubit

Brian — Fri, 23 May 2008 17:22:25 +0000

Yeah, Cornell CS students! I’m proud of you guys. Looks like my old Operating Systems professor (Prof. Sirer) is involved as well. Cool.

Brian Tarricone: No GSoC

Brian — Wed, 19 Mar 2008 07:45:37 +0000

Sadly, we didn’t get accepted into Google’s Summer of Code this year. It’s a shame, but I’m glad I went through the effort to apply. If nothing else, we got some potentially-useful ideas and possibly some developer interest. Obviously we can’t fund any of these people, but it would be great if they still want to contribute.

Update: The coordinator got back to me, and said our ideas page wasn’t very fleshed out, and that we should look at other accepted applicants and the program guidelines for help on how to do this right… never mind that I actually *did* look at some older accepted projects, and their ideas lists were at times even more sparse than ours (though many were much more formally written up as well). Also she gave the usual “we can’t accept every great project” excuse, which at least gives some hope for next year. I’m not particularly sure I want to go through the work to apply again, but maybe someone else will.

Brian Tarricone: The King

Brian — Mon, 17 Mar 2008 19:46:14 +0000

I am apparently a “Cool Nerd King”:

I think I’m happy about that, actually.

Brian Tarricone: Xfce and Google’s Summer of Code

Brian — Tue, 04 Mar 2008 22:54:37 +0000

While we haven’t been accepted into the program yet, we (Xfce) are applying to participate in the 2008 Google Summer of Code as a mentoring organisation. Please see our wiki page for more information, and add your name to the students list if you’d like to work on one of the projects. Feel free to add to the project ideas list as well.

If you’d like to act as a mentor, you still have a few more days before I submit the application. Add your name to the mentors list and email me to let me know.

Brian Tarricone: Video

Brian — Wed, 27 Feb 2008 23:01:03 +0000

Sweet! I got a brief mention in TiNDC #35. Now that I’m back to Linux after a 2-week stint on MacOS X, hopefully I’ll be able to help out some more. Not that I don’t have other things I’m supposed to be working on…

Brian Tarricone: Really Persistent Connections

Brian — Thu, 21 Feb 2008 23:40:40 +0000

A little background: a month or so ago, I set up a 6to4 IPv6 tunnel at home, and set up IPv6 addressing on my home LAN. All the machines on my home LAN are routable on the IPv6 internet now. I put a corresponding tunnel on the router of my development network at work (yes, I properly firewalled both networks).

So, here’s the progression of events today:

My MacBook is on the dev network at work via wired ethernet. I ssh to my laptop at home on my LAN through the IPv6 tunnel.
Later, I need to go to a meeting, so I unplug the ethernet cable and turn wireless on, connecting to our corporate WLAN, which has no IPv6 support at all, and connects to the internet via a completely different pipe than the dev network.
I’m in the conference room downstairs for a half hour during the meeting.
I come back to my desk, switch off wireless, and plug the original ethernet cable back in.
A bit later, I switch back to iTerm, and notice the terminal with the ssh session open, which hasn’t timed out on my end yet. Not too surprising, so I go to hit enter a few times to see if it’ll die before I take the more drastic action of closing the window and opening a new one.
I press enter, and… the other end responds! The ssh session is still alive, despite the fact that I’ve been on another network for a good 30 minutes.

Say what?

Brian Tarricone: Reverse Blog

Brian — Mon, 04 Feb 2008 22:50:01 +0000

Over the past year-ish I’ve turned this blog into more of a private journal, sometimes writing a public post here and there (from mostly public, with occasional private entries). I just updated Wordpress to version 2.3.2, which was long overdue, as I’d been running 2.0.9 for a very long time. Not much has changed, it seems, which is good in some ways (I didn’t have to touch my theme for the new version), and not so great in others (I was hoping for a couple new features, maybe stuff that I hadn’t even thought of but would find cool).

At any rate, I’d like something a bit opposite of what Wordpress currently offers. I want the default action to be post privately, with a separate button or setting I can hit to publish it. Currently it’s a little awkward. There’s a per-post “Post Status” setting, which can be one of Published, Pending Review (not sure what this does; 2.0.9 didn’t have it), Draft, and Private. The default is Draft, but that’s a little misleading. There are three buttons: Save and Continue Editing, Save, and Publish. The two Save buttons keep the Draft status. The Publish button acts like the Save button, but “helpfully” also sets Post Status to Published.

This UI is kinda confusing, and a bit prone to error: on more than one occasion I’ve published something I’ve wanted to keep private (fortunately no harm was done as I noticed the error quickly). I’m not sure what a better UI might be. One option is to just have two buttons: Save and Continue Editing, and Save. Then the Post Status field would always be maintained when clicking either of those buttons. As a consequence, the default Post Status would probably be Published. As a bonus, it would be great if the default Post Status were configurable. Then I could set it to Private and selectively change things to Published when I want to. Anyone know if there’s a way to achieve a similar effect (with Wordpress)?

Brian Tarricone: On Broken ACPI DSDTs

Brian — Thu, 24 Jan 2008 09:49:53 +0000

A couple months ago, I replaced the AMD Sempron 3100+ (1.8GHz) in my HTPC with a newer AMD Athlon64 3200+ (2.2GHz). It’d been having some trouble multitasking: specifically recording and watching HD content at the same time could often cause stuttering, especially if the commercial flagger was running at the same time. It also had issues with some higher-bitrate 1080p content. So, I got the replacement CPU.

I swapped CPUs (scaring myself to death when I realised I’d almost broken the socket when the CPU got stuck to the heatsink, and I yanked the CPU out of the socket without lifting the ZIF lever), and noticed an odd error on boot:

powernow-k8: Found 1 AMD Athlon(tm) 64 Processor 3200+ processors (1 cpu cores) (version 2.00.00)
ACPI Exception (processor_perflib-0234): AE_NOT_FOUND, Evaluating _PSS [20070126]
powernow-k8: BIOS error - no PSB or ACPI _PSS objects
ACPI Exception (processor_perflib-0234): AE_NOT_FOUND, Evaluating _PSS [20070126]

Basically, that means the powernow-k8 driver was reporting that it wasn’t provided a _PSS or PSB block in the ACPI DSDT, so it didn’t know about any CPU P-states, and thus CPU frequency scaling wouldn’t work. Since I do sometimes leave the machine on idle, this was a bit annoying, since it’d be burning some power that it wouldn’t otherwise need to burn.

So, I googled a bit (oh, sorry, “performed some Google searches”), but didn’t find anything particularly promising. I checked the BIOS settings; yes, the “AMD Cool’n'Quiet” feature is enabled. I tried disabling it, rebooting, and then re-enabling, and rebooting, but no luck.

Fast-forward a couple months. A few days ago, I ran across something that reminded me of the problem. Some stuff about many motherboard manufacturers/BIOS writers providing crappy DSDTs in their ACPI implementation (the DSDT is what tells an ACPI-compliant OS what ACPI features are supported, and how to used them). So, I found a nice resource that told me how to fetch the DSDT from my BIOS, and decompile it for inspection.

According to the decompiled source, the DSDT was compiled with Microsoft’s compiler, which, I understand, is kinda crappy in that it lets a lot of errors past. When I tried to recompile my DSDT with Intel’s compiler, it threw 6 errors and around 20 warnings. I poked around at the errors, and, with some helpful pointers, I managed to fix the errors, or just comment out the portions causing fatal errors that I was pretty sure don’t do anything useful anyway.

The errors, however, didn’t seem to have anything to do with the missing P-state descriptions, though I did notice that the DSDT source was missing either a _PSS section or PSB section, as the kernel complained about.

So I googled some more, and came across this guy, who seemed to have a similar problem, but with his Athlon64 X2. He basically said he noticed that his processor description sections were empty, and found a DSDT on the Linux ACPI website for a similar motherboard that happened to have the proper _PSS entries, and copied them over, tweaking them a bit. Fortunately he also posted the sections he added.

Now, the X2 isn’t really the same chip as mine, but it was a place to start. I googled a bit more, and found another guy with a similar problem, and this guy even has the exact same CPU (down to the generation) as I do! Unfortunately, though his post seems to indicate he resolved the problem, he didn’t post a how-to, but did mention he got some information from some documentation from AMD.

So, off to AMD’s website. Cool, they provide quite a bit of technical documentation for their CPUs. I grabbed the BIOS and Kernel Developer’s guide to my CPU, and started looking for stuff about “_PSS”. Fortunately, it wasn’t hard to find (the doc is over 450 pages long). The structures and values I found from the X2 guy’s website are documented, and it gave some good defaults for some of the timing-related pieces.

Unfortunately, AMD’s specs don’t cover my particular spin of the CPU, so I couldn’t figure out what P-states my CPU supports, or what voltages they should run at, or what the power dissipation is for each state.

So, I had to fudge some values and make some stuff up. Wikipedia says my CPU runs at 59 W. Fair enough. But that’s for the default 2.2GHz frequency and 1.4V voltage. But what about lower frequencies? I decided to arbitrarily pick 1.6GHz at 1.3V and 800MHz at 1.2V for my other 2 P-states (presumably I could pick more, at 200MHz increments, but I wanted to keep it simple). Running a CPU at a lower lower voltage when underclocking is generally a reasonable thing to do; though dropping the voltage too low is probably a bad idea. But what about power dissipation? According to the specs, only the max/default P-state has to have its power dissipation value specified exactly. All slower P-states can be estimated. Good news. I just simply took the 59 W value and scaled it down based on both the frequency ratio and voltage ratio. Is that exact? No, certainly not. But it’s probably not totally off the mark.

One value eluded me. One of the values is a control register that needs to get set. The control register has 7 different sub-values. AMD’s documentation gives good defaults for six of them. The last one, PLL_LOCK_TIME, seems pretty important: it’s the time it takes for the processor PLLs to re-lock after a state change. A PLL is essentially a clock generator. You have a phase detector and some kind of oscillator (where you can change the freqency), and then a feedback path that has some kind of divider circuit. Anyhow, I lucked out on this one: the X2 guy provided values for these, and since his values for all the other six seemed to match mine, I crossed my fingers and hoped his PLL_LOCK_TIME is the same as mine.

So, whew. I added the missing _PSS section to my DSDT, with the three P-states, and recompiled it, fortunately without errors. (I decided not to bother with the existing warnings because I’m lazy.) Now, how do we use it? According to the original Gentoo forum page I was looking at, you can either patch the kernel to use a file that you have to put in the kernel source tree in a particular location, or you can patch the kernel to read the DSDT out of an initrd. Boo, I don’t wanna patch my kernel. So I googled a littler more, and it appears that recent kernels have a better option: you can enable a kernel config parameter, and it’ll let you specify a path to a header file (helpfully generated by the DSDT compiler) to use. So, ‘make menuconfig’, and I dig around for the option. Not there. Oh, I need to disable the “Select only drivers that don’t need compile-time external firmware” option. Ok… still not there. I search for config options with “DSDT” in them, and find that the one I want requires that CONFIG_X86_VOYAGER isn’t set (which it isn’t), CONFIG_ACPI is set (which it is), and CONFIG_STANDALONE isn’t set (which it isn’t, now that I disabled it). But still, no option. So, let’s try another tack. I quit menuconfig, and open .config in a text editor. I remove the one DSDT-related line, save it, and run ‘make oldconfig’. Now, it prompts me for the DSDT-override option, and, when I select it, I get prompted for a file location. Nice. And lame. But mostly nice. So, I recompile (first intentionally negelcting to copy the header file to the location I specified, just to make sure it would error out, confirming that the option was enabled), install the kernel image, and reboot. The box comes up, I ssh in, and check dmesg:

powernow-k8: Found 1 AMD Athlon(tm) 64 Processor 3200+ processors (1 cpu cores) (version 2.00.00)
powernow-k8:    0 : fid 0xe (2200 MHz), vid 0x6
powernow-k8:    1 : fid 0x8 (1600 MHz), vid 0xa
powernow-k8:    2 : fid 0x0 (800 MHz), vid 0xe

Oh, yes. Yes, that’s nice. I cat /proc/cpuinfo, and see that my CPU is now running at 800MHz (I have the machine set up to use the ‘ondemand’ cpufreq governor, which sets the frequency to the lowest needed given the system load). I dig around in /sys/devices/system/cpu/cpu0/cpufreq/, setting different governors and speed values, and checking that /proc/cpuinfo reports the new speed. Success!

Presumably, I could add more P-states, but I think 1600MHz and 800MHz will do. For those of you with similar problems, my motherboard is a DFI K8M800-MLVF. Feel free to use my hacked DSDT if you have the same motherboard, or as a reference point if you have another Socket 754 system or similar CPU. Of course, I offer this with no warranty and accept no liability, and if your system explodes, it’s your responsibility and all that.

See also: my AMD _PSS notes, and my AMD _PSS value table.

Brian Tarricone: Air

Brian — Wed, 16 Jan 2008 06:02:53 +0000

I’m a bit disappointed in the newly-announced MacBook Air. I want one, but… I don’t.

The good:

Super-thin form factor: 0.16″ to 0.76″.
MacBook Pro-style aluminum case.
Small size: 13.3″ widescreen display.
802.11n wireless (dual-band 2.4/5 GHz).
Intel GMA graphics (very well supported on Linux, even if it’s not as ‘powerful’ as nvidia/ATI).
Backlit keyboard.
LED-backlit display.
Multi-touch trackpad (though I have no idea how well-supported or useful it’ll be on Linux).

Unfortunately, we have quite a bit of the bad:

No built-in ethernet (USB dongle sold separately, but that rules out gigabit).
No built-in optical drive (I expected this; I don’t mind).
Only one USB port. So if I get the USB ethernet dongle and/or the external USB optical drive, I have to choose which one I want to use. And if I’m somewhere where there’s no wireless, and I have to use a USB flash drive, I have to disconnect the network. Lame.
Non-user-replaceable battery. (I imagine it’s possible, though somewhat difficult, like replacing the hard drive in my PowerBook was.) This is somewhat annoying for me since I tend to have the machine on 24/7, and as such I’m a bit harsh on the battery (I leave it plugged in while fully charged for long periods of time).
RAM is not upgradeable (soldered to motherboard). Comes with 2GB standard, so probably not too much of a problem.
Relatively slow CPU given today’s state-of-the art. (Granted, 1.8GHz dual-core should be plenty for me.)
The IBM X-series used to use the 1.8″ 4600 RPM hard drives, but switched back to 2.5″ drives because of large performance problems with the 1.8″ drives.
No dedicated graphics memory (144MB shared with system RAM).
Only a single speaker (mono sound). Though, do you really notice stereo separation with a pair of crappy speakers about a foot apart?
A concern: will the laptop hold up? It’s very thin. Aluminum is definitely bendable (as my 12″ PowerBook which no longer sits flat will confirm).
MacBook-style keyboard. I’m not a huge fan of the keyboard on the MacBook I have at work. I far prefer the keyboard on my PowerBook (and on the MacBook Pro).

I’m not considering buying one now; not only should I not be spending the money now, but I wouldn’t dare buy first-gen Apple hardware. So fortunately there will be time to see if my concerns about the laptop’s durability are warranted, ditto for my concerns about hard drive performance. And it’s possible there might be a refresh in 6-8 months that includes better graphics, more RAM, a faster CPU, or even (however unlikely) an extra USB port or an ethernet jack.

I guess the issue is that I was really hoping for a 12″ (or 13.3″, though I’d prefer 12″) MacBook Pro, essentially an Intel-based replacement for the 12″ G4 PowerBook. I knew that wasn’t what Apple was going to announce, but I was hoping it wouldn’t be too far off the mark.

I’m still undecided, but I’m going to give myself at least 6 months to think about it, and probably more. Likely I wouldn’t buy one until the fall. There’s also the hope that there will be a major MacBook Pro refresh before then that improves the MBP situation a bit. Given the introduction of the MBA, I seriously doubt they’d start selling a 13.3″ MBP, but it’s possible they might somehow make the 15″ MBP more attractive to me. Unfortunately, I just don’t really like the MacBook’s aesthetics; I wouldn’t really consider buying a 13.3″ MacBook for myself. We’ll see what happens, I suppose.

Jasper Huysmans: It´s a girl!

Jasper — Mon, 14 Jan 2008 19:49:11 +0000

I´m very proud to present to you my daughter:

Cute photograph

Her name is Leonie and she was born on Sunday, January 6, 21:06 CET. She is undoubtedly the most beautiful baby in the world. You´re thinking all fathers say that, but I´m sure this time it is true ;-)

Benedikt Meurer: Thunar 0.9.0, exo 0.3.4 and thunar-volman 0.2.0 release

Benedikt Meurer — Sun, 02 Dec 2007 15:49:08 +0000

I just released new versions of <a href="http://thunar.xfce.org/">Thunar</a>, exo and <a href="http://www.foo-projects.org/~benny/projects/thunar-volman/index.html">thunar-volman</a> with several bugfixes and new translations. They are part of Xfce 4.4.2, which will be released tomorrow.</content>

Moritz Heiber: Growing up

moe — Mon, 19 Nov 2007 20:18:22 +0000

When I was young and started to grow up I immediately was afraid of the possibility to become .. well, the usual type of person I shared my daily routine or personal life with. Like, say .. I started studying computer science when I finished high school just to quit after a year since I became more and more afraid of being a dull, self-centered, moronic prick .. which most of my fellow students were, actually (and no, I'm not exaggerating). If you were to describe what I thought my future would look like back in those days .. '40 year old virgin' comes to mind ^_~

Anyway, a couple of you reading my blog (or shall I say the few of the few) know: I've been working in Spain the past couple of years. Throughout the summer. Its been fun. And its also given me the opportunity to explore the means I can work in and work with. Essentially its been an experiment to find myself. Which, in the end and for most parts, didn't go very well. But thats another story. What I gathered though was a quite good understanding about who I am .. and what I wanted in life. Sounds rather philosophical, right? I guess its the typical 20'ish to 23'ish experience every grown up has to go through.

However, with the experience I gathered from my work in Spain, put together with the experience coming from acting studies (which I kind of quit .. I didn't put enough effort into it in the end .. thats something I really need to work on) I realized lately: Its not your environment that shapes you. Its not your friends. Its not the clothes you wear, the car you drive, the school you go to. Its not your parents either, or your girlfriend. Or your job.

It is you. And what you make of it.

And while that sounds awfully simple (and pathetic of sorts) .. believe me, its not. Even if I hadn't quit studying computer science .. I sure as hell would not have become the same prick I had to sit with in computer-math. Or any other class. I might have been influenced .. but only in a positive way, believe me (meaning: away from being a prick since I had so many of them around me). All my life I've been worrying about how to adapt to certain situations, friends, other random people .. company policies .. so much that I largely forgot about who I actually am and how I define myself. Luckily, I caught the right train and ended up knowing what I know now: I know who I am. Yet, it took a painful 24 years to finally catch that. But I guess thats what people mean when they're talking about growing up. However, now I can finally focus on living the life I want to live instead of trying to fit in. And thats about the most refreshing and meaningful experience I've had since .. well, 24 years.

Cheers, Moritz

PS: No, I'm not Auke Kok .. but Auke Kok is on vacation and http://bar.foo-projects.org doesn't know about me unless he tells it to.

Moritz Heiber: Music

moe — Sun, 18 Nov 2007 21:00:26 +0000

Hey, I know I haven't been exactly busy blogging lately. But since Auke lost all my previous postings (:-P) I figured it would be a good time for a fresh start. Right now, there's tons of stuff I could probably talk about. I'm not much of blogger I guess. But recently I "discovered" a couple of amazingly good tracks I'm listening to frequently lately...

Jens Luedicke: Warlord, Inc.

Jens — Sat, 20 Oct 2007 14:47:58 +0000

I’d like to see the government get out of war altogether and leave the
whole field to private industry.
– Joseph Heller

Zum Thema passend aus der taz vor ein paar Tagen:
Warlord, Inc.

Auke Kok: Early adopters pay the price, Apple evading taxes? iPhone perils...

sofar — Tue, 11 Sep 2007 01:42:23 +0000

I read the news about apple & AT&T dropping the iPhone price by 200$. Of course at first I laughed at the suckers who fell for the obvious trap, but it poses a more interesting dilemma for "early adopters".

Today AT&T also announced that they sold the first 1 million iPhones. Given the fact that they can now comfortably sell them at 200$ below the original price, they will at least have already made 200 million. It's much more likely that the 100 million that they will give back in the form of store vouchers was a deal between AT&T and Apple so that AT&T can fund Apple's development cost in a very interesting tax-evading method. This borders the lines of money-laundering and very sleazy money schemes if you ask me.

Not to mention that those same suckers won't be able to buy $100 worth of stuff in the Apple store without at least spending 50$ more on something else, feeding the everlasting loop of greed of Apple, sucking stupid rich people into it's vile trap. I'm just kidding, it's all business as usual, right?

So, in the end the early adopters on average are going to spend the base amount of the phone, plus 100$ (since they're not getting the full 200$ divergence back, only half), and end up spending on average 10-25% more than that in the Apple store when they redeem their credit. The end score: on average, Joe Sucker still only gets back 75$, which is becoming quite marginal.

Here's what Apple should have done: sold the first 1 million phones under the 400$ price point. Apple would have probably made enough money to cover the basics, and they would have sold the units within a month, instead of 6 months. Advertising would freak out, people would instantly get one (now!) instead of postponing and waiting out, and the fact that for e.g. other hi-tech products this works quite good (think of hi-quality game betas being handed out for free), would be a win-win situation for both Apple and the consumer.

In the end, Apple and AT&T decided to bill the early adopters completely unfairly, and gets more press and more revenue by doing this flip-somersault that will end up just increasing their revenue anyway, and in a dubious legal way if I may say so.

Jasper Huysmans: Vala > C ?

Jasper — Sun, 05 Aug 2007 15:04:51 +0000

Brian writes about ObjC being much nicer to work with than plain old C for GUI work. I just came across an interesting project that tries to improve the situation: Vala.

It’s a new language with C#-like syntax with a compiler that generates C code. Could be interesting. Although, generally speaking, code generators suck, you shouldn’t have to deal with the generated code at all in this case. The code is written in Vala, which is compiled to native code, but if you create a library it will have (or generate?) an API that is compatible with C.

I am going to have to try this some time (because, you know, I have lots of free time to spend on playing around with obscure programming languages, oh wait, I don’t ;-) So, has anyone else tried this?

Jens Luedicke: Doping

Jens — Mon, 30 Jul 2007 13:03:38 +0000

Ich kann mir gut vorstellen das gewisse Anti-Doping Zeloten nicht davor zurückschrecken würden bei Doping-Proben Hand anlegen (lassen) um positive Resultate zu erzielen.

Jens Luedicke: HEDI SLIMANE

Jens — Sun, 15 Jul 2007 17:01:08 +0000

HEDI SLIMANE DIARY

(via)

Jens Luedicke: Apple iProduct

Jens — Thu, 05 Jul 2007 12:42:23 +0000

Apple iProduct

(via)

Jens Luedicke: Theorie vs. Technik

Jens — Sun, 27 May 2007 15:55:29 +0000

Lesenswert: http://sushee.schreibsturm.org/article/1655/technik-statt-theorie

Benedikt Meurer: A Visual Tour of Xfce 4.4.0